Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 142 total.
Information exposure via unauthenticated share access in filebrowser (CVE-2026-46410)
An unauthenticated user can access shared content in a way that exposes sensitive information, including source and path details. This vulnerability allows unauthorized parties to obtain data that should be protected,...
Fixed in 1.3.2-stable; 1.4.1-beta
Privilege escalation via self-service REST API in Apache Syncope (CVE-2026-62183)
An improper privilege management vulnerability in Apache Syncope allows an authenticated user to escalate their own privileges via a REST API call. Under certain workflow adapter configurations, a user can assign them...
Fixed in 4.0.7; 4.1.2
SQL injection in Apache Syncope Audit Events search (CVE-2026-57308)
Apache Syncope contains an SQL injection vulnerability in its Audit Events search functionality. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized sort...
Fixed in 4.0.7; 4.1.2
Path traversal in FileBrowser Quantum subtitle handler endpoint (CVE-2026-54910)
The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) in FileBrowser Quantum accepts two user-controlled query parameters, `path` and `name`, both of which are used in filesystem operations without sanitization...
Fixed in 1.4.3-beta
Missing authorization on ApprovalInbox GET routes in Network-AI (CVE-2026-64622)
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, allowing unauthenticated actors to retrieve full Ap...
Fixed in 5.13.4
Signature verification bypass in Network-AI APSAdapter (CVE-2026-64623)
APSAdapter in the network-ai npm package initialises with a `local` verification mode by default. When no custom `verifySignature` callback is supplied, the built-in fallback verifier accepts any non-empty string as a...
Fixed in 5.13.4
Confused deputy privilege escalation in SurrealDB via future fields and functions (CVE-2026-63763)
Unprivileged users with roles such as database editor can create or modify record fields containing futures, functions, or closures. Because these constructs execute in the context of the querying or invoking user rat...
Fixed in 2.5.0; 3.0.0-beta.3
Denial of service in SurrealDB JSON parser via nested objects (CVE-2026-63760)
The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. An unauthenticated remote attacker can exploit this by sending a deeply...
Fixed in 3.1.0
Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)
SurrealDB's type/kind parser failed to enforce the configured recursion depth limit when processing nested type annotations, unlike the expression parser which already applied this limit. An authenticated attacker can...
Fixed in 3.1.0
Session hijacking via unauthenticated /rpc session enumeration in SurrealDB (CVE-2026-63757)
The HTTP `/rpc` `sessions` method in SurrealDB returned all attached session UUIDs without requiring authentication, and the `/rpc` handler accepted arbitrary session identifiers with no ownership verification. An una...
Fixed in 3.1.0
TOCTOU race condition in SurrealDB HTTP RPC endpoint (CVE-2026-63756)
SurrealDB's HTTP /rpc endpoint contains a time-of-check/time-of-use (TOCTOU) race condition in which concurrent requests share mutable authentication state. An unauthenticated request racing against an active authenti...
Fixed in 3.1.0
Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)
SurrealDB evaluates user-supplied WHERE clauses and SET/MERGE/CONTENT/PATCH clauses against full record data before enforcing table-level PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user, including Rec...
Fixed in 3.1.0
Denial of service via malicious LIVE queries in SurrealDB (CVE-2026-63754)
A LIVE query whose WHERE clause evaluates to an error causes the error to propagate to the triggering write transaction, rolling back the attempted change. An authenticated user with only select permission on a table ...
Fixed in 3.1.0
Denial of service via malformed RPC `use` call in SurrealDB (CVE-2026-63747)
SurrealDB's RPC `use` handler panics when a database is specified without a namespace, because the handler calls `.expect("namespace should be set")` and the core library is built with `panic = 'abort'`, causing the p...
Fixed in 3.1.0
Table SELECT permission bypass via graph traversal in SurrealDB (CVE-2026-63746)
Authenticated record or scope users in SurrealDB can read records from any table reachable through graph edges or REFERENCES TO back-references, bypassing that table's PERMISSIONS FOR select clause entirely. The flaw ...
Fixed in 3.1.0
Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)
SurrealDB fails to correctly enforce element-level (`field.*`) SELECT permissions for record users. Instead of hiding denied array elements, the engine leaks a subset of them due to incorrect index handling during per...
Fixed in 3.1.4
Arbitrary file read via DEFINE ANALYZER mapper filter in SurrealDB (CVE-2026-63739)
SurrealDB's DEFINE ANALYZER mapper() filter allows database users with the EDITOR or OWNER role to specify arbitrary file paths and retrieve file contents through query error messages. File access is intended to be re...
Fixed in 3.1.5
Denial of service via deep operator chains in SurrealDB (CVE-2026-63737)
Authenticated users can crash a SurrealDB server by submitting a single query containing a long chain of operators (e.g., tens of thousands of chained addition terms). The query is parsed into an unbounded expression ...
Fixed in 3.1.5
Tenant scope bypass in SurrealDB custom API routes (CVE-2026-63735)
Authenticated users in any namespace/database can invoke custom API endpoints belonging to other namespaces/databases by specifying the target scope in the URL path or via namespace/database headers. The route applied...
Fixed in 3.2.0
Heap-based buffer overflow in Wazuh agent syscheck registry wildcard expansion (CVE-2026-40106)
A heap-based buffer overflow exists in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards, the agent allocates a fixed 256-byte heap buffer and performs unsafe st...
Fixed in >=4.14.5